9f55ef3ac53c8025fcd7a870f55b9b6c0a692ce5abfcc2b8a17e64a8882478bf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8322cb58ef166d8eeb1989a1ac4e49ee_JaffaCakes118.pdf
Size

89KB
MD5

8322cb58ef166d8eeb1989a1ac4e49ee
SHA1

8b5e5cdd0105a2841dd67be6bff10879529f561d
SHA256

9f55ef3ac53c8025fcd7a870f55b9b6c0a692ce5abfcc2b8a17e64a8882478bf
SHA512

534951de50e7002f203869c708919fdaf45f720f0a66960377a5ac77a83e8346095a7ed6dbd1b50c0491c25251a6dd965adaa060de6327d8d2ecb3664991697e
SSDEEP

1536:uxwTWFhRdlYRSsEs9Wu7C9qO8WIALvER2KrWepOyWW+lJWH5B3s5XDkh1:ZW3Rz/s9Wu7oqVDSvER2KoyYaCTS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe
2620	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8322cb58ef166d8eeb1989a1ac4e49ee_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
737b796dd939082c8dbe40602af368f4

SHA1
d1381a988c2656728cf6099d571396acb64e5563

SHA256
2a3dbefe0faecdcfe6a2fb682b2c763a0163ac401e1e58594df351e43bad230d

SHA512
4c96c4440b39999a007f7a1a73aa80c4a983a07881b378eefd1baa974c8281be5ff46f72de2bfe9224f814bc2bdef8c22f27ea42ea71e81cf4bd807a7b8e1ee5

Download Submit